Bug 23101 - Contracts permissions for staff patron
Summary: Contracts permissions for staff patron
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Acquisitions (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low minor (vote)
Assignee: Katrin Fischer
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-06-12 08:39 UTC by Mohamad Barham
Modified: 2021-06-14 21:29 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
19.11.00,19.05.05


Attachments
vendor page (102.88 KB, image/png)
2019-06-12 08:39 UTC, Mohamad Barham
Details
Bug 23101: Hide action buttons on contracts if user lacks permission (3.97 KB, patch)
2019-07-13 08:39 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 23101: Hide action buttons on contracts if user lacks permission (4.00 KB, patch)
2019-09-12 14:32 UTC, ByWater Sandboxes
Details | Diff | Splinter Review
Bug 23101: Hide action buttons on contracts if user lacks permission (4.05 KB, patch)
2019-09-20 20:36 UTC, Bouzid Fergani
Details | Diff | Splinter Review
Bug 23101: Hide action buttons on contracts if user lacks permission (4.16 KB, patch)
2019-09-27 08:10 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 23101: (follow-up) use NoSort class in datatable (1.79 KB, patch)
2019-10-08 12:07 UTC, Fridolin Somers
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Mohamad Barham 2019-06-12 08:39:54 UTC
Created attachment 90527 [details]
vendor page

Dears,

Koha 19.00

I have created a staff Patron with no Contracts permissions only (
Manage basket and order lines,Receive orders and manage shipments )

In the vendor page, the patron can view contracts and actions button are available (delete, edit), if he click one of those actions, will redirected to the login page.

so, my recommendation, to remove those action bottoms at all if the user dont have the permission.

Regards
Comment 1 Katrin Fischer 2019-07-13 08:39:01 UTC
Created attachment 91510 [details] [review]
Bug 23101: Hide action buttons on contracts if user lacks permission

When the user doesn't have superlibrarian, full acq or
contracts_manage permission, don't show buttons for editing
and deleting contracts.

To test:
- Create a vendor with a few contracts
- Create a staff user with
  - superlibrarian = can view edit/delete contracts
  - full acq perms = same
  - without manage_contracts = can view, but action buttons are gone
- Make sure the sorting of the contracts table works in all cases
Comment 2 ByWater Sandboxes 2019-09-12 14:32:36 UTC
Created attachment 92729 [details] [review]
Bug 23101: Hide action buttons on contracts if user lacks permission

When the user doesn't have superlibrarian, full acq or
contracts_manage permission, don't show buttons for editing
and deleting contracts.

To test:
- Create a vendor with a few contracts
- Create a staff user with
  - superlibrarian = can view edit/delete contracts
  - full acq perms = same
  - without manage_contracts = can view, but action buttons are gone
- Make sure the sorting of the contracts table works in all cases

Signed-off-by: hc <hc@interleaf.ie>
Comment 3 Bouzid Fergani 2019-09-20 20:36:02 UTC
Created attachment 93053 [details] [review]
Bug 23101: Hide action buttons on contracts if user lacks permission

When the user doesn't have superlibrarian, full acq or
contracts_manage permission, don't show buttons for editing
and deleting contracts.

To test:
- Create a vendor with a few contracts
- Create a staff user with
  - superlibrarian = can view edit/delete contracts
  - full acq perms = same
  - without manage_contracts = can view, but action buttons are gone
- Make sure the sorting of the contracts table works in all cases

Signed-off-by: hc <hc@interleaf.ie>
Signed-off-by: Bouzid Fergani <bouzid.fergani@inlibro.com>
Comment 4 Marcel de Rooy 2019-09-27 08:10:49 UTC
Created attachment 93185 [details] [review]
Bug 23101: Hide action buttons on contracts if user lacks permission

When the user doesn't have superlibrarian, full acq or
contracts_manage permission, don't show buttons for editing
and deleting contracts.

To test:
- Create a vendor with a few contracts
- Create a staff user with
  - superlibrarian = can view edit/delete contracts
  - full acq perms = same
  - without manage_contracts = can view, but action buttons are gone
- Make sure the sorting of the contracts table works in all cases

Signed-off-by: hc <hc@interleaf.ie>
Signed-off-by: Bouzid Fergani <bouzid.fergani@inlibro.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 5 Martin Renvoize 2019-09-27 12:59:31 UTC
Nice work!

Pushed to master for 19.11.00
Comment 6 Fridolin Somers 2019-10-08 07:13:55 UTC
I'm sure about :

+                    [% IF CAN_user_acquisition_contracts_manage %]
                     { "aTargets": [ -1 ], "bSortable": false, "bSearchable": false },
+                    [% ELSE %]
+                    { "bSortable": false, "bSearchable": false },
+                    [% END %]
                     { "sType": "title-string", "aTargets" : [ "title-string" ] }

Shouldn't we remove the all line instead of only "aTargets" ?
Comment 7 Fridolin Somers 2019-10-08 11:54:30 UTC
Confirmed on irc, we need to use a class for no-sorting.
I'm on a patch
Comment 8 Fridolin Somers 2019-10-08 12:07:14 UTC
Created attachment 93864 [details] [review]
Bug 23101: (follow-up) use NoSort class in datatable
Comment 9 Martin Renvoize 2019-10-08 13:16:51 UTC
Nice work!

Pushed to master for 19.11.00
Comment 10 Martin Renvoize 2019-10-08 13:17:28 UTC
Followup pushed, thanks Fridolin
Comment 11 Katrin Fischer 2019-10-08 15:47:44 UTC
Thx a lot, Frido!
Comment 12 Fridolin Somers 2019-10-09 08:03:01 UTC
Pushed to 19.05.x for 19.05.05
Comment 13 Lucas Gass 2019-11-13 23:04:14 UTC
backported to 18.11.x for 18.11.11